Labs PortSwigger — Test d’intrusion web

Contexte

Matière : _Test d’intrusion web · Les 34 labs de la Web Security Academy cités dans les 3 supports, dédoublonnés. (P) = Practitioner, sinon Apprentice. Avancement réel : tableau de bord de son compte sur portswigger.net.

Outils

Burp Suite Community + extensions : Autorize (contrôle d’accès), JWT Editor, Turbo Intruder (brute force, courses), Hackvertor (encodages), Content Type Converter (JSON → XML pour XXE), Param Miner (en-têtes cachés), Logger++.

A01 · Broken Access Control — Jour 1

☐	Lab	Outil
☐	Insecure direct object references	Repeater
☐	User ID controlled by request parameter	Autorize / Repeater
☐	User role controlled by request parameter	Repeater (cookie)
☐	Unprotected admin functionality	robots.txt, navigateur
☐	File path traversal, simple case	Repeater
☐	Basic SSRF against the local server	Repeater
☐	Basic SSRF against another back-end system	Intruder / Turbo Intruder (balayage d’IP)
☐	CSRF vulnerability with no defenses	exploit server
☐	CORS vulnerability with basic origin reflection	exploit server

A02 · Security Misconfiguration — Jour 1

☐	Lab	Outil
☐	Exploiting XXE using external entities to retrieve files	Repeater (+ Content Type Converter si JSON)
☐	Information disclosure in version control history (P)	wget -r du .git + git log
☐	Source code disclosure via backup files	navigateur (robots.txt, /backup)
☐	Information disclosure in error messages	Repeater (paramètre invalide)
☐	Host header authentication bypass	Repeater / Param Miner

A04 · Cryptographic Failures — Jour 2

Pas de lab propre : le cours renvoie vers JWT authentication bypass via weak signing key (A07), Information disclosure in version control history et Source code disclosure via backup files (A02), Information disclosure in error messages (A02).

A05 · Injection — Jour 2

☐	Lab	Outil
☐	SQL injection vulnerability allowing login bypass	Repeater
☐	SQL injection vulnerability in WHERE clause allowing retrieval of hidden data	navigateur / Repeater
☐	Blind SQL injection with conditional responses (P)	Turbo Intruder (ou sqlmap)
☐	Detecting NoSQL injection	Repeater
☐	Reflected XSS into HTML context with nothing encoded	navigateur
☐	Stored XSS into HTML context with nothing encoded	navigateur
☐	DOM XSS in document.write sink using source location.search	DOM Invader (navigateur Burp)
☐	OS command injection, simple case	Repeater
☐	Blind OS command injection with time delays (P)	Repeater (sleep)
☐	Basic server-side template injection (classé Practitioner sur PortSwigger, Apprentice dans le support)	Repeater

A06 · Insecure Design — Jour 3

☐	Lab	Outil
☐	Excessive trust in client-side controls	Repeater (prix)
☐	Limit overrun race conditions	Repeater → groupe → Send in parallel
☐	Bypassing rate limits via race conditions (P)	Turbo Intruder

A07 · Authentication Failures — Jour 3

☐	Lab	Outil
☐	Username enumeration via different responses	Turbo Intruder
☐	2FA simple bypass	navigateur
☐	Password reset broken logic	Repeater
☐	JWT authentication bypass via unverified signature	JWT Editor
☐	JWT authentication bypass via weak signing key (P)	JWT Editor + hashcat -m 16500

A08 · Software or Data Integrity Failures — Jour 3

☐	Lab	Outil
☐	Modifying serialized objects	Repeater + Decoder / Hackvertor
☐	Arbitrary object injection in PHP (P)	Repeater + Hackvertor

Catégories sans lab

• A03 Supply Chain : npm audit / pip-audit sur un projet obsolète ; dépôt GitHub de test avec une action non épinglée (bac à sable).
• A09 Logging : pas de lab, cours seulement (log injection).
• A10 Exceptional Conditions : reprend Information disclosure in error messages.
• Comptes par défaut (A02), hachage / TLS (A04) : démos en cours, pas de lab.